Privacy Policy
What Justified stores about you, who can see it, and how to get it removed.
Last updated 6 October 2026.
Who Handles Your Data
KORDU LTD operates Justified and justified.gg, and is the data controller for everything described on this page. Company number 16836154, registered in England and Wales. The registered office is First Floor Office, 3 Hornton Place, London W8 4LZ. Email abuse@justified.gg.
What We Store
When you sign in. Steam provides your SteamID, display name and avatar.
If you link Discord. Your Discord account ID, your username, the email address on that account if Discord provides one, and the sign-in tokens that keep the link active.
While you are signed in. A session record: when it started, when it expires, the IP address you signed in from and your browser's user agent string. The session lasts 7 days from last use, or until you sign out. Expired records may remain until we clear them.
When you use the site. We may store the IP address you connected from for a short time, to prevent abuse of sign-in and the gallery.
When you play. The game server records your connection IP, your in-game display name, your playtime, how often you connect, when you first and last played, your levels, the jobs you work, the districts you spend time in, your gang and rank, your kills, your deaths and your favourite weapon. Your public profile is built from these. Connection IPs are used for bans and abuse prevention.
When you use the desktop app. The app reads files on your PC to check your setup: which Steam account is signed in, whether Garry's Mod and the server's content are installed, your Garry's Mod settings and addons, and its crash reports. None of that leaves your PC. To fill its pages it asks justified.gg for patch notes and your public profile, which sends us your SteamID. It asks our API for live events and asks the game server whether it is up. Each of these sees your IP address, as any website you visit does. Your app settings are saved on your PC.
If you sign the desktop app in. The app gets its own session, recorded like a browser's: when it started, when it expires, the IP address and the app's name and version as its user agent. It lasts 7 days from last use, or until you sign out in the app. The app keeps the session in your PC's credential store and uses it to read your account: your name, whether your Discord is linked, your goals and daily crate, and which of your Steam friends and gangmates are on the server, by name. To find your friends it sends us the SteamIDs from your PC's Steam friends list; we use them for that answer and do not keep them. While Garry's Mod is running it asks us which server your public Steam profile says you are on, which we ask Steam. To tell you whether the linked Discord is the one on your PC, the app reads your Discord name from the Discord app. That stays on your PC.
Your PC specs. While the desktop app is signed in, it sends us your PC's hardware so we can help with support tickets and see what our players play on: the processor, graphics cards and their drivers, how much memory and of what type, the Windows version, each display's resolution and refresh rate, the size and type of the drive Garry's Mod is on, and which Garry's Mod branch you use. It sends no serial numbers, device IDs, PC or user names, or file paths. It sends them again only when they change. Turn off "Share my PC specs with Justified" in the app's Settings and we delete them.
If you show your game on Discord. While you play or wait for a slot, the app tells the Discord app on your PC which game, mode and server region you are on, when you started, your job and its level, your gang, the server's live events, and a link to your public profile. Your district is added only if you turn it on. Discord then shows it on your profile to anyone who can see your activity. It goes straight from your PC to Discord, not through us. Turn it off in the app's Account page, or in Discord's activity privacy settings.
When you upload. The image, and everything you attach to it: title, caption, alt text, tags, map, district, job, gang, when it was captured and which server you were on. We also store the file's fingerprint, its size, its dimensions and which version of the terms you agreed to.
Your IP when you upload. A hashed form of the address, kept for 30 days.
Gallery activity. Your likes, your comments and any report you send us.
Dupes. The file saved on the server, its title and description, the SteamIDs of the creator, seller and buyers, the in-game price, and the ratings and reports on it. We also store records of who accessed a dupe and any refund message you send us. We keep the uploaded copy under the licence in the terms.
If you buy a rank. Tebex tells us which package was paid for and which Steam account to grant it to. Card and billing details stay with Tebex.
Moderation records. What a moderator did to an upload, when they did it and why, including notes sent to our staff channel. These outlive the upload. An upload ban is stored the same way.
Usage counters. To monitor server health, we keep simple activity counters in our platform provider's analytics service: how long players were active in each reporting window, and whether a session started or ended. Each counter uses a coded identifier derived from your SteamID, not the SteamID itself. These counters are kept for 90 days.
Cookies
A session cookie, set when you sign in, keeps you signed in for 7 days. Signing in with Steam or linking Discord sets short-lived cookies while the handshake runs. No advertising cookies. No analytics cookies.
The network in front of the site may set its own cookies to keep the site up and block attacks.
We use these cookies to provide sign-in and to protect the site. We do not use them for advertising or to track you across other sites.
Why We Use It
- To provide your account, your uploads, your dupes and the services you ask for. This processing is necessary to perform our contract with you.
- To prevent abuse of the server and the gallery, and to operate public profiles and a public gallery. These are our legitimate interests.
- To respond to copyright complaints and to requests from the police or a court. This processing is required to meet our legal obligations.
Who Can See What
Anyone can see your Steam display name and avatar, your public profile and the stats on it (including kills, deaths and favourite weapon), your approved uploads with your name beside them, your comments, and any dupe you have listed as public. Wallet, inventory and base holdings do not appear on public pages.
A Steam avatar on a public page is loaded from Steam's servers, so Steam can see the visitor's IP address.
Staff can see your email address, your session records (including the sign-in IP), anything a moderator wrote about you, and any upload waiting for review or already rejected.
The loading screen shows approved uploads, with the uploader's name, to every player joining the server.
We Do Not Sell Your Data
We do not sell your personal data. We do not use advertisers, data brokers or ad networks.
Who Else Handles It
We share personal data with:
- Hosting, storage, database and network providers
- Steam, for sign-in and for avatars shown on public pages
- Discord, if you link an account, when we send staff moderation notes, and when the desktop app shows your game on your Discord profile
- Tebex, the store seller, if you buy a rank
- The police or a court, when the law requires it
The game server and the site run in the EEA. Some of the providers above process data in the United States. Transfers from the UK to the EEA rely on the UK's adequacy regulations. Where a US provider is certified under the UK Extension to the EU-US Data Privacy Framework, that adequacy decision covers the transfer. For any other US transfer, email abuse@justified.gg and we will tell you which safeguard applies and how to obtain a copy.
How Long We Keep It
| What | How long |
|---|---|
| Account and Steam profile data | While your account exists |
| Session records | 7 days from last use, or until you sign out. Expired records may remain until we clear them |
| Sign-in and gallery rate-limit IPs | For a short window after each request. Leftover records may remain until we clear them |
| Discord link | Until you unlink it |
| Gameplay stats | While your account exists |
| Comments, likes and reports | While the related upload or your account exists, or until you delete a comment |
| Approved uploads | Until we remove one, or you email us to withdraw it |
| Rejected upload files | 30 days, then the file is deleted. The rejection record may remain with moderation records |
| Fingerprints of files removed for abuse | While we still need them to block the same file |
| Hashed uploader IP | 30 days |
| Dupe listings | While the listing is public, then while we still need the file for copies already sold or for abuse records |
| In-game dupe purchases | While we still need the record to run the marketplace |
| Game connection logs | For as long as a ban that used them is in force, and otherwise while we still need them for that investigation |
| Usage counters | 90 days |
| Desktop app settings | On your PC, until you remove the app |
| PC specs from the desktop app | Until you turn off sharing in the app, which deletes them |
| Moderation records | While we still need them for appeals, repeat abuse and legal requests |
| Refund request messages | While we still need them to handle that request, then with the related purchase or moderation record |
Your Rights
Under UK data protection law you can ask us to:
- Provide a copy of the personal data we hold about you
- Correct anything inaccurate
- Delete it
- Restrict how we use it
- Provide it in a portable format you can take elsewhere
You also have the right to object to processing based on our legitimate interests, including public profiles, the public gallery and abuse prevention. Email abuse@justified.gg and we will stop that processing unless we have compelling grounds to continue.
A Steam account is required to hold a Justified account. To exercise any of these rights, email abuse@justified.gg. We will ask you to prove the Steam account is yours, then respond within one month.
On request we delete your account, your uploads and your stats. Deletion is handled manually; there is no self-service delete. Fingerprints of files removed for abuse, moderation records, dupes still needed for copies other players hold, and anything the law requires us to keep are retained.
You can complain to us first by emailing abuse@justified.gg. We acknowledge complaints within 30 days and inform you of the outcome.
You can also complain to the Information Commissioner's Office at ico.org.uk. If you live in the EEA, you can also complain to your local data protection authority.
Children
You must be 13 or older to have an account. If we find that an account belongs to someone younger, we delete it. A parent or guardian can email abuse@justified.gg to have a child's account and uploads removed.
Changes
We update this page when our data practices change. The date at the top shows the current version, and we announce significant changes in the Discord.